Amnesty International and the Open Institute are urging the government to clarify its stance on the protection of data collected by the Worldcoin cryptocurrency.
On Friday, Amnesty noted that the preliminary review statement issued on August 2, 2023, by the Office of the Data Protection Commissioner (ODPC) and the Communications Authority (CA) raised concerns about the security and storage of the sensitive data collected.
The ODPC and the CA expressed worries over insufficient information regarding security measures and the data collected by Worldcoin.
The civil societies expressed deep concern, stating, 'Preliminary statements from State agencies suggest a significant data breach in Kenya. We urgently call for thorough and independent investigations by the Data Commissioner.'
According to the lobbyists, the Data Protection Act stipulates that Worldcoin, which processes sensitive personal data, should have conducted a data protection impact assessment at least 60 days before commencing processing.
"We request the regulator to clarify whether Worldcoin submitted a Data Protection Impact Assessment report as mandated by law and whether their operations met compliance requirements," the lobbyists stated.
They further emphasized that the Office of the Data Protection Commissioner should ensure impartial and unbiased investigations into Worldcoin's data collection activities in Kenya.
Amnesty referred to the cryptocurrency Worldcoin as a diversion, asserting that the central issue lies in data collection.
The lobbyists cast doubts on the potential deceptive nature of the cryptocurrency incentives for Kenyans, suggesting that the true objective of data collection might not have been disclosed.
Addressing the concern of consent, the lobbyists stated, 'While Worldcoin claims that consent is the lawful basis for processing personal data, there are valid grounds to suspect that Worldcoin might not have obtained proper consent as defined by the Data Protection Act.'
They highlighted that Kenya's Data Protection Act mandates consent to be explicit, clear, free, specific, and informed.
The lobbyists also noted that individuals who queued to have their irises scanned were not adequately informed about the Terms and Conditions they were agreeing to.
Amnesty called on the regulator to confirm whether Worldcoin obtained consent in alignment with Kenya's Data Protection Act.
Furthermore, they urged that once the investigations are concluded, the ODPC should share their findings with the Kenyan public.
"We urge all government agencies to fully cooperate with the Data Protection Commissioner during this investigation," the lobbyists emphasized.
On August 9, Interior Cabinet Secretary said Government is narrowing down on those behind the controversial Worldcoin activities.
Kindiki said the government already mapped all individuals behind the registrations of citizens through a collection of eyeball/iris data.
The CS told Parliament that the local agents of the foreign firm have already recorded statements and the security agencies are currently pursuing their accomplices who are out of the country.